Add concurrency group to PR Tooling Safety Check workflow

[Copilot]

The push-repo-memory job failed with remote: fatal error in commit_refs when pushing to the safety/scanned-PRs branch. This is a server-side race condition triggered when multiple workflow runs attempt to push to the same branch concurrently.

• Add explicit concurrency group with cancel-in-progress: false to ensure at most one run executes at a time (queued runs still complete, no scans lost)
• Recompile lock file

concurrency:
  group: labelops-pr-security-scan
  cancel-in-progress: false

Follows the same pattern already used by labelops-pr-maintenance.md.

[T-Gro]

LGTM. The fix correctly serializes workflow runs to prevent the race condition on push-repo-memory pushes to safety/scanned-PRs.

• Static concurrency group name (labelops-pr-security-scan) is unambiguous — no risk of expression-resolution issues.
• cancel-in-progress: false ensures queued scans still complete (no lost work).
• Lock file changes are expected recompilation artifacts from the source change.
• Follows the same pattern as labelops-pr-maintenance.

[github-actions]

✅ No release notes required